Linux Kernel Bugs · Slashdot Mirror

Posted by michael on Friday October 19, 2001 @01:59AM from the patching-time dept.

Armin Herbert writes: "According to this mail from Rafal Wojtczuk and a german article on Heise Online, there's a new severe bug in all Linux Kernels, from 2.2.0 up to 2.4.10, which allows users to become root on your system. Kernel 2.4.12 fixes this problem, and RedHat, Caldera and other distributors already supply patches for their Kernels. See Bugtraq for more information." Important notes for anyone running a multi-user system. Update: 10/19 16:12 GMT by J : If I'm reading Nergal's writeup correctly, 2.4.10 is still vulnerable to the local DoS, but not to the local root exploit. Separate issues. And as pheared points out, there is one unverified report of a custom 2.4.12 being vulnerable as well; please try the exploit on your system and let us know what you find. This is a big one, you can expect the kiddies have already added this to their rootkits. Update your systems now!

1 of 307 comments (clear)

Min score:

Reason:

Sort:

Re:"Only" a local root exploit by Nailer · 2001-10-19 11:46 · Score: 1, Redundant

If you want to compare to Windows: up till Windows XP it wasn't even possible to be logged in as multiple users at the same time, so the equivalent of a local root exploit was not really possible.

NT has has the ability to run su type programs for a very long time (since the NT4 resource kit).

There's been multiuser (albeit remote) version of NT since Citrix released their NT 3.51 Terminal Server.